Rippling

Rippling AI takes authenticated action in systems Rippling does not own, with the systems and the direction named. The AI FAQ states that Rippling AI "can manage third-party apps that are connected through Rippling's identity and access management," and gives worked examples: it can "use the features of the integration to grant employees access to Zoom or check who has access to Slack."

The product page adds the write side at scale: "reclaim unused licenses" and "stage deprovisioning without pinging employees or sifting through endless portals," and spreadsheet bonuses that the agent maps, flags, gets approval for and "executes the command" in over 185 countries. The workflows page closes it: "the resulting actions can run inside Rippling or out in the tools your team already uses."

A second connector estate is named separately. Rippling Data Cloud connects third party business systems "from HubSpot to Zendesk," and the developer host publishes Pipelines for bringing external data into Rippling through managed connectors, custom API pipelines and Snowflake.

The vendor states its own ceiling: Rippling AI "does not trigger or execute other actions that are not already supported by the integration, such as creating a Jira ticket." That describes how any integration mediated agent behaves rather than a Rippling specific cap, and it names the edge of the reach.

Sourcerippling.com/platform/ai FAQ and /platform/workflowsread 2026-09-12

The customer facing orchestration surface is a named product with its own page. A customer describes a process in plain language and "Rippling AI builds the trigger, conditions, routing, and actions, and you can adjust anything through simple conversation." Those four elements are authored rather than hard coded, and the flow is reviewed and published as a unit. Actions land inside Rippling or "out in the tools your team already uses," so a single flow spans systems.

Multi step work is documented end to end on real sequences. Onboarding runs across devices, apps and employee data in one place: "See who's starting, what's shipped, and what access they have." A bulk payroll action maps the data, flags issues, takes approval and executes across 185 countries. License reclamation finds unused seats and stages deprovisioning. Each has distinct stages, a branch on conditions and a terminal write.

Participants are distinct, which makes it orchestration rather than a macro: the admin who authors and approves, the agent tier that plans and executes, the employee who self serves, and managers and other employee types who can be granted access to build their own workflows. Delegated authoring is itself an orchestration property: "Rippling can securely grant managers and other employee types access to the data you want them to have, and the ability to build their own workflows," so flows are authored at the edge under central permission.

Rippling's engineering account describes a supervisor agent coordinating read, retrieval and action agents, the internal architecture behind the product.

Sourcerippling.com/platform/workflows and /platform/airead 2026-09-12

The corpus is a standing system of record, not context assembled per run. The FAQ names the sources: Rippling AI is "integrated with your live Rippling data and Rippling help center content out of the box." That is two distinct corpora, one structured and one documentary, both maintained continuously and both queried rather than pasted in. Rippling's engineering writeup describes the data model at thousands of tables and hundreds of thousands of fields.

The customer can extend it: "To further customize Rippling AI, you can upload additional documents to share context and improve company-specific answers for employees." An ingestion path into a store the customer curates is a maintained retrieval structure.

Retrieval is grounded, and the grounding is verifiable per answer: numbers and names come back as clickable links to the underlying records. Rippling positions the product on this: "Natively built on your HR, finance, and IT data, Rippling AI connects dots no other tools can." It answers across HR, payroll, benefits, policy, spend, device and app access data in one query, and employees self serve personalized pay, benefits and policy explanations from the same store.

Retrieval respects the permission boundary at read time, so the corpus is scoped per requesting user rather than flattened.

Sourcerippling.com/platform/ai product page and FAQread 2026-09-12

The approval gate is stated unconditionally. Asked whether the AI acts on its own, the FAQ answers: "No. Any action Rippling AI proposes requires explicit human confirmation before execution." The product page repeats it as a named pillar: "Always stay in control: before it takes action, it gets your approval, so your critical tasks never go off course." There is no tier gate, no configuration required and no carve out for low risk actions; the hold covers every action the agent proposes.

This is a shipped review and approve surface, documented at the point of the consequential act. On a bulk payroll run the agent "will map the data, flag issues, get your approval, and execute the command," and on bulk data correction the changes run "with simple prompts and your confirmation."

A second gate sits one layer up, on the workflow rather than the action: "Rippling shows you exactly what triggers a workflow, what it does, and who it affects before anything goes live. You review the reasoning, confirm the output, and publish."

Agent initiated changes also go through whatever approvals the company already requires, the same as if a person had made them. That chain is the customer's own. Admins can also enable or disable AI features entirely.

Sourcerippling.com/platform/ai product page and FAQ, with /platform/workflowsread 2026-09-12

Seven held certifications are named on Rippling's security page, with scope stated for each: SOC 1 Type 2 covering eleven control areas from information security and operations to change management and payroll processing, audited annually; SOC 2 Type 2 covering Security, Confidentiality and Availability, audited annually; SOC 3, published openly with a download link; CSA STAR Level 2, described as "independent third-party validation of its security controls against the Cloud Security Alliance Cloud Controls Matrix"; ISO 27001; ISO 27018 for personal information; and ISO 42001, which Rippling states demonstrates its commitment to "secured and governed AI management." All are stated as held, in the present tense, with no hedge. A trust center at trust.rippling.com carries the same list.

ISO 42001 stands apart: it is an AI management system certification rather than a general infosec one, and it is uncommon.

Customer facing controls sit on the AI surface itself. Rippling AI "automatically inherits your existing Rippling permissions, so every response is scoped to what the requesting user is authorized to see," stated again as "Rippling AI runs on your existing permissions, so employees never see data they shouldn't." Rippling contrasts this with trusting a model to filter or redact correctly: the boundary is enforced by the permission system, not by the model.

Admin control over the agent is documented: "Admins can enable or disable AI features, manage Rippling AI admin permissions, and configure data permissions at the platform level." Agent Identity Management extends the same model to the agents themselves, with agent records holding assigned owners and permissions alongside employees and service accounts, "known, owned, permissioned, auditable, and revocable from one system." Rippling is itself an IAM and MDM vendor, so the access surface is the product.

Sourcerippling.com/trust/security and /platform/ai FAQread 2026-09-12

Three customer facing surfaces are documented, and the third matters most.

Citation to source: "Every Rippling AI answer contains clickable links to the source record and data so you can verify answers," restated on the product page as "numbers and names appear as clickable links to real records, so you can quickly see where answers come from."

Reasoning inspection: "Plus, you can also view the underlying logic and validate results."

An action log, named on the AI page in the agent's own IT use case: "Resolve IT issues with audit trails" and "handle device and access issues fast, with built-in approvals, permissions, and logging."

The action log is what sets it apart. A score or citation answers why this answer; an audit trail answers what the agent did. Rippling names logging and audit trails on the agent's action path, not only citations on its answers. Agent Identity Management reinforces it at the estate level, with agents auditable and revocable from one system and visibility into what each does, though that governs the customer's agent fleet.

Rippling's engineering writeup also describes a shared, queryable trace store over agent executions in production. That is Rippling's own engineers watching their own agents, vendor side visibility rather than a customer facing surface.

The audit trail phrase sits in a use case card rather than on a page that enumerates the log, and no retention period, export path, field list or operator view of agent actions is documented.

Sourcerippling.com/platform/ai product page and FAQread 2026-09-12

Only state within a run is documented. A REPL maintains a runtime variable store between agent steps, but cross session agent memory is not documented. A variable store that lets one agent hand a named reference to the next inside a single execution is an implementation detail of tool calling, not a memory layer, and it does not survive the run that created it.

Nothing else in the product is agent memory either. The single live model of the customer's data across thousands of tables is a database, the corpus the agents query. The employee record itself (comp, role, device status, app access) is the customer's application data, however persistent it is.

Uploaded context documents are a knowledge artifact the customer maintains. Agent Identity Management, announced in Rippling's AI governance post, creates persistent "agent records with owners and permissions" alongside employees and service accounts; that is identity and entitlement configuration, durable but not state the agent accumulates.

Rippling publishes no named memory component, no retained preference or correction the agent reapplies to later requests, no decision trace carried between sessions, no stated scope or lifetime for anything the agent holds, and no customer surface to inspect, edit, export or purge agent state separately from employee records. The AI FAQ itemizes data handling down to the commitment that "usage data will not be used to train AI models," which says where interactions do not go and names no store where they persist.

Sourcerippling.com/platform/ai product page and FAQread 2026-09-12

Hosting is stated as a single region. Rippling's security page says: "All data is housed in physically secure, US-based AWS data centers across multiple availability zones." That is one geography, named by the vendor, for all data. Multiple availability zones are a resiliency property inside one region, not a residency choice.

No selection surface exists or is implied: no region list, customer controlled or dedicated environment, or point at which a buyer chooses where data sits is published.

Two things can read as multi region and are not. The same page carries a locale switcher for eight country sites: Australia, Canada in English and French, France, Germany, Ireland, the United Kingdom and the United States. Those are market and language sites. Payroll runs in more than 185 countries. Neither is residency: a vendor can sell and pay people in 185 countries while holding every byte in US AWS, and Rippling says it does.

Here the region is named and there is exactly one. A buyer in the EU with a data localization requirement has no documented option.

The same page also carries seven attestations, along with penetration testing, WAF and SDLC controls.

Sourcerippling.com/trust/securityread 2026-09-12

Capability ships prebuilt rather than being assembled by the customer, and the units are enumerated by use case on the product page: routine HR question handling, executive reporting on headcount, hiring and comp, plan versus actual tracking, variance explanation, outlier detection on travel and software spend, onboarding status, license reclamation and IT issue resolution.

Specialized agents are separately documented for payroll troubleshooting, interview transcript summarization and talent performance calibration. Each is a distinct job a customer can put to work on day one, and the FAQ states no setup or training is required.

Still, these are capabilities of one assistant, not complete agents a buyer selects among. Nothing is individually installable, removable or priced, and removing one does not leave the others as whole products; they are the same agent pointed at different data. Enterprise vendors like the word agents in the plural, and the ones a customer can actually adopt here number one.

The AI page also advertises "Discover 100+ prompts from HR, finance, and IT leaders" with an "Explore the prompt library" link; whether that library is a browsable in product catalog or a gated marketing download is not stated.

Rippling Solutions delivers custom apps and automations built by Rippling's own engineers, an engagement rather than the platform, and App Shop is an integration marketplace.

Sourcerippling.com/platform/airead 2026-09-12

Event triggering is the workflows page's own headline claim. rippling.com/platform/workflows reads "Trigger on anything" and "Run workflows anywhere," and states that "any data in Rippling or your connected third-party apps can kick off a workflow, and the resulting actions can run inside Rippling or out in the tools your team already uses." The trigger set is enumerated by the data it reads: every employee's "role, location, tenure, comp, device status, and app access."

Third party event sources are named. With Rippling Data Cloud a customer connects third party business systems "from HubSpot to Zendesk, so any signal from any system can trigger a workflow." That is an external event bus feeding the trigger layer.

The authoring path is conversational but the trigger is not. A customer describes the process in plain language and "Rippling AI builds the trigger, conditions, routing, and actions." Conversation is how the trigger gets written, not how it fires.

Channel coverage sits alongside: admin and employee conversational entry inside Rippling, employee self service for pay, benefits and policy questions, and spreadsheet ingestion where a customer drags in bonuses for payroll across more than 185 countries. Schedules appear in the same family through off cycle pay runs and routine admin tasks run on request.

Sourcerippling.com/platform/workflows and /platform/airead 2026-09-12

No model or provider is named for Rippling's own agent, and there is no picker, admin setting, per agent assignment or bring your own key path for Rippling AI itself. The AI FAQ itemizes the AI's data handling closely enough to commit that "usage data will not be used to train AI models," and still identifies no provider.

Rippling's AI Gateway looks like model choice and is not.

Rippling's AI governance announcement describes it as "one governed path for LLM traffic" that "sits between employees, apps, agents, and model providers," so that "admins can control access to models, set budgets, enforce spend limits, and log usage," with OpenAI, Anthropic and Google named as providers employees and agents call directly.

An admin choosing which models their own staff may use is governance over the customer's model estate. It says nothing about which model runs Rippling AI's own retrieval, reasoning or message generation.

The ISO 42001 certification for "governed AI management" is an attestation about process, not a second model.

Neither vendor side routing across more than one model nor customer or admin control of the model Rippling AI uses is documented.

Sourcerippling.com/platform/ai FAQ, with /blog/introducing-rippling-ai-governance read through the search index and counted only as a refusalread 2026-09-12

Rippling documents a public REST API built for calls from outside: the APIs "empower customers to integrate with Rippling seamlessly from their own infrastructure." Rippling's engineering post at rippling.com/blog/enterprise-grade-apis documents the API in implementation detail.

Production REST traffic runs on a dedicated domain, rest.ripplingapis.com, with a separate sandbox domain at rest.ripplingsandboxapis.com. The design is REST with plural noun collection resources, /workers and /users named, and a singular sso-me endpoint returning caller scoped context.

Pagination is cursor based with limit and cursor parameters, a next_link and a results array, defaulting to 50 and capping at 100. Versioning is header based via Rippling-Api-Version, with a default version bound to the API token so that new releases cannot break an existing integration. Field expansion is supported through an expand parameter, up to ten fields and two levels of nesting.

The specification is published and downloadable. OpenAPI specifications are generated automatically from the DTO class definitions and versioning annotations and converted into the documentation pages on developer.rippling.com, which give customers "the ability to download the specs in OpenAPI format and try out the APIs with sample requests directly from the website," with search across the reference.

Authentication uses API tokens, and OAuth tokens for third party applications, with access token scopes following a {resource}.{read|write} convention, granted only within the issuer's own permission profile. The canonical documentation entry is developer.rippling.com/documentation/rest-api. Alongside the REST API the portal publishes App Studio, Functions for serverless code on the platform, Pipelines, Transformations and an App Shop partner program for integrations reaching Rippling customers.

The engineering post predates the current documentation site, which Rippling has since rebuilt, so specifics such as the pagination defaults or the versioning header may have moved. The portal navigation suggests an SDK without documenting one, and no customer facing MCP server is documented.

Rippling's MCP Gateway governs which MCP servers the customer's own staff may use and is separate from calling Rippling itself.

Sourcerippling.com/blog/enterprise-grade-apis, with developer.rippling.com existence verified by direct fetchread 2026-09-12

A mature internal program of production debugging and evaluation covers Rippling's own agents, using traces, layered evals and a semi automated self healing loop that catches regressions, as its engineering writeup describes. That is Rippling's own quality process: the buyer receives the outcome, not the harness. No page states that a customer can run an eval, define a test set or read a result.

What the customer gets is a quality gate with no readable result, on three surfaces separate from the action approval gate. First, impact analysis on a change before release: "Rippling shows you exactly what triggers a workflow, what it does, and who it affects before anything goes live."

Second, a validation pass inside execution: on a bulk payroll action the agent "will map the data, flag issues, get your approval, and execute," and the issue flagging step is a check on the work, separate from the consent step that follows. Third, result inspection: a customer can "view the underlying logic and validate results."

No test environment, sandbox, holdout, versioning, evaluator or scored verdict about agent behavior is documented for the AI surface. Nothing states that a changed workflow is exercised against a known set before it reaches employees; it is described, previewed and approved, not run and measured. There is no score, pass rate or judge verdict.

A sandbox does exist, for a different job. Rippling's engineering post names a separate non production API environment on its own domain, rest.ripplingsandboxapis.com, and header based API versioning lets a customer pin a version and test a newer one by changing a header.

Both are real pre deployment testing surfaces for the customer's own integration code against Rippling's API, not for anything the agent does. Nothing states that Rippling AI, its workflows or its agents run in the sandbox, so it tests the caller's change and not the agent's behavior. Plan versus actual reporting measures the customer's payroll operation rather than the agent.

Sourcerippling.com/platform/workflows and /platform/ai, with /blog/enterprise-grade-apis for the sandbox refusalread 2026-09-12

Rippling's AI acts through data and integrations, not through a screen. The AI FAQ states that Rippling AI "operates on data and flows inside Rippling" and, where it reaches outward, "uses the features of the integration," and it cannot go beyond what the integration supports. By the vendor's own account, that is an API mediated, non visual action path, so it does not depend on interface elements that can change. No hosted or local browser, desktop session, remote or local computer control, RPA or recorder is documented.

Device management comes closest. Rippling ships MDM: it provisions and manages employee devices, stages deprovisioning, reclaims licenses, and its security page describes instantly disabling departing employees' "devices, apps and access rights" with Rippling's IAM and MDM products. Remote control of endpoints can look like computer use, but MDM acts through a managed agent and administrative APIs rather than by operating a visual interface, and it is device administration rather than the AI agent driving a machine.

Sourcerippling.com/platform/ai FAQ and /trust/securityread 2026-09-12